This page lists the IAM roles and permissions for Certificate Authority Service. To search through all roles and permissions, see the role and permission index .
Certificate Authority Service roles
CA Service Admin
( roles/
)
Full access to all CA Service resources.
privateca.*
-
privateca.caPools.create -
privateca.caPools. createTagBinding -
privateca.caPools.delete -
privateca.caPools. deleteTagBinding -
privateca.caPools.get -
privateca.caPools.getIamPolicy -
privateca.caPools.list -
privateca.caPools. listEffectiveTags -
privateca.caPools. listTagBindings -
privateca.caPools.setIamPolicy -
privateca.caPools.update -
privateca.caPools.use -
privateca.certificateAuthorities. create -
privateca.certificateAuthorities. delete -
privateca.certificateAuthorities. get -
privateca.certificateAuthorities. getIamPolicy -
privateca.certificateAuthorities. list -
privateca.certificateAuthorities. setIamPolicy -
privateca.certificateAuthorities. update -
privateca.certificateRevocationLists. create -
privateca.certificateRevocationLists. get -
privateca.certificateRevocationLists. getIamPolicy -
privateca.certificateRevocationLists. list -
privateca.certificateRevocationLists. setIamPolicy -
privateca.certificateRevocationLists. update -
privateca.certificateTemplates. create -
privateca.certificateTemplates. createTagBinding -
privateca.certificateTemplates. delete -
privateca.certificateTemplates. deleteTagBinding -
privateca.certificateTemplates. get -
privateca.certificateTemplates. getIamPolicy -
privateca.certificateTemplates. list -
privateca.certificateTemplates. listEffectiveTags -
privateca.certificateTemplates. listTagBindings -
privateca.certificateTemplates. setIamPolicy -
privateca.certificateTemplates. update -
privateca.certificateTemplates. use -
privateca.certificates.create -
privateca.certificates. createForSelf -
privateca.certificates.get -
privateca.certificates. getIamPolicy -
privateca.certificates.list -
privateca.certificates. setIamPolicy -
privateca.certificates.update -
privateca.locations.get -
privateca.locations.list -
privateca.operations.cancel -
privateca.operations.delete -
privateca.operations.get -
privateca.operations.list -
privateca.reusableConfigs. create -
privateca.reusableConfigs. delete -
privateca.reusableConfigs.get -
privateca.reusableConfigs. getIamPolicy -
privateca.reusableConfigs.list -
privateca.reusableConfigs. setIamPolicy -
privateca.reusableConfigs. update
resourcemanager.projects.get
resourcemanager.projects.list
storage.buckets.create
CA Service Auditor
( roles/
)
Read-only access to all CA Service resources.
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
resourcemanager.projects.get
resourcemanager.projects.list
CA Service Operation Manager
( roles/
)
Create and manage CAs, revoke certificates, create certificates templates, and read-only access for CA Service resources.
privateca.caPools.create
privateca.
privateca.caPools.delete
privateca.
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.caPools.update
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.certificates.update
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.
privateca.
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
privateca.
resourcemanager.projects.get
resourcemanager.projects.list
storage.buckets.create
CA Service Certificate Manager
( roles/
)
Create certificates and read-only access for CA Service resources.
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.create
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
resourcemanager.projects.get
resourcemanager.projects.list
CA Service Certificate Requester
( roles/
)
Request certificates from CA Service.
privateca.certificates.create
Privateca Editor
( roles/
)
Editor role for privateca
privateca.caPools.create
privateca.caPools.delete
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.caPools.update
privateca.caPools.use
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.create
privateca.
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.certificates.update
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.*
-
privateca.operations.cancel -
privateca.operations.delete -
privateca.operations.get -
privateca.operations.list
privateca.
privateca.
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
privateca.
resourcemanager.projects.get
resourcemanager.projects.list
CA Service Pool Reader
( roles/
)
Read CA Pools in CA Service.
privateca.caPools.get
CA Service Certificate Template User
( roles/
)
Read, list and use certificate templates.
privateca.
privateca.
privateca.
Privateca Viewer
( roles/
)
Viewer role for privateca
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
resourcemanager.projects.get
resourcemanager.projects.list
CA Service Workload Certificate Requester
( roles/
)
Request certificates from CA Service with caller's identity.
privateca.
Certificate Authority Service permissions
privateca.caPools.create
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Tag User
( roles/
)
privateca.caPools.delete
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Tag User
( roles/
)
privateca.caPools.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
CA Service Pool Reader
( roles/
)
Privateca Viewer
( roles/
)
Service agent roles
- Managed Kafka Service Agent
(
roles/)managedkafka.serviceAgent
privateca.caPools.getIamPolicy
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.caPools.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
privateca.caPools.setIamPolicy
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.caPools.update
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.caPools.use
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Tag User
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Tag User
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
CA Service Certificate Template User
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
CA Service Certificate Template User
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Certificate Template User
( roles/
)
Privateca Viewer
( roles/
)
privateca.certificates.create
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Certificate Manager
( roles/
)
CA Service Certificate Requester
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Workload Certificate Requester
( roles/
)
privateca.certificates.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.certificates.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Service agent roles
- Cloud Security Compliance Service Agent
(
roles/)cloudsecuritycompliance.serviceAgent - Audit Manager Auditing Service Agent
(
roles/)auditmanager.serviceAgent
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.certificates.update
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.locations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.locations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.operations.cancel
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
privateca.operations.delete
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
privateca.operations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.operations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
privateca.reusableConfigs.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.reusableConfigs.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Privateca Editor
( roles/
)
